Topic starter
17/08/2026 4:37 pm
TL;DR: Developers are being asked to treat identity as code, unify visibility across humans, machines, and AI, and enforce just-in-time access as software systems and non-human identities proliferate, according to SailPoint. The governance challenge is no longer whether identity can be automated, but whether lifecycle, policy, and remediation can keep pace with runtime behaviour.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Shaping the future: how every developer can embrace adaptive identity”.
Key questions
Q: How should security teams implement identity as code in developer workflows?
A: Start by moving access policy definitions, approval logic, and remediation triggers into version-controlled workflows that can be tested and reviewed before deployment.
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect.
Q: What breaks when shadow AI is not included in identity governance?
A: When shadow AI is excluded, the organisation loses discovery, ownership, and enforcement at the same time.
Practitioner guidance
- Embed identity policy in delivery pipelines Version-control access rules, require peer review for policy changes, and deploy them through the same release process used for application code.
Bottom line: Developer-led identity governance is shifting from console administration to code-driven control, which changes where policy is written and enforced.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:43 pm
Identity governance is becoming a software delivery discipline. When access policy is version-controlled and deployed through CI/CD, the control plane moves from console administration to engineering workflow. That changes how teams should think about drift, review, and enforcement because the governance boundary is now code quality as much as policy design. Practitioners should treat identity engineering as part of the release system, not a separate back-office function.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How can teams tell whether adaptive identity is actually improving control?
A: Look for evidence that access decisions, anomaly detection, and remediation are happening in the same operational flow rather than in separate manual queues. If policy changes still depend on ticket backlogs or periodic cleanup, the programme is automating administration but not governance.
👉 Read our full editorial: Adaptive identity for developers is becoming an NHI control layer